parrottalks extension also affected (40k users) kkodiihpgodmdankclfibbiphjkfdenh
t.co/SMFH07Gnv8

Uvoice (40k downloads) also compromised today using uvoice[.]live
oaikpkmjciadfpddlpjjdapglcihgdle
t.co/hGkxieETWj

VPNCity chrome extension also affected chromewebstore.google.com/detail/vpnci... more than 50k users. Using the vpncity[.]live domain

There is code to receive commands from the malicious domain:

including internxtvpn[.]pro
The extension dpggmcodlahmljkhlmpgpdcffdaoccni - Internxt VPN chromewebstore.google.com/detail/inter... was updated December 25th that added a new content script that runs on every url (cont)

Google IS dancing

See you in Baides Austin next week.